A set of custom connectors used to power up automation capabilities.
Connectors
Cron Scheduled Connector
Description
A custom connector created to trigger playbooks by a given alert product, name
and type and enables editing the parameters according to your specific use
case. Allows the use of a cron expression.
Using the Run Every parameter, we recommend updating the connector's scheduled execution from 59 seconds to 1 hour
and the cron expression accordingly (* 16 * * FRI) to reflect the new schedule.
This change ensures that the connector code runs once every hour. The execution
is not guaranteed to occur exactly at the top of the hour—it will be triggered once at some point during the specified hour.
Configuration
To configure a connector, go to Settings -> Connectors -> Create New
Connector and search for Cron Scheduled Connector.
Parameters-
Parameter
Type
Default value
Is Mandatory
Description
Run Every
Integers
10 seconds
No
Specify the run schedule.
Product Field Name
String
Yes
Specify the source field name to retrieve the Product Field name.
Event Field Name
String
event_type
Yes
Specify the source field name to retrieve the Event Field name.
Alert fields
JSON
Yes
Specify the Alert fields you would like to insert in JSON format.
Alert name
String
Yes
Specify the Alert fields associated with the alert that will be created.
Alert type
String
No
Specify the Alert type associated with the alert that will be created.
Cron expression
String
* * * * *
No
If defined, will determine when the connector should create a case.
Product Name
String
No
Specify the product name associated with the alert that will be created.
PythonProcessTimeout
Integer
30
Yes
Specify the timeout limit (in seconds) for the python process running
the current script.
Scheduled Connector
Description
A custom connector created to trigger playbooks by a given alert product, name
and type and enables editing the parameters according to your specific use
case.
Configuration
To configure a connector, go to Settings -> Connectors -> Create New
Connector and search for Scheduled Connector.
Parameters
Parameter
Type
Default value
Is Mandatory
Description
Run Every
Integers
10 seconds
No
Specify the run schedule.
Product Field Name
String
Yes
Specify the source field name to retrieve the Product Field name.
Event Field Name
String
event_type
Yes
Specify the source field name to retrieve the Event Field name.
Alert fields
JSON
Yes
Specify the Alert fields you want to insert in JSON format.
Alert name
String
Yes
Specify the Alert fields associated with the alert that will be created.
Alert type
String
No
Specify the Alert type associated with the alert that will be created.
Product Name
String
No
Specify the product name associated with the alert that will be created.
PythonProcessTimeout
Integer
30
Yes
Specify the timeout limit (in seconds) for the python process running
the current script.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[[["\u003cp\u003eThis page describes custom connectors within Google SecOps SOAR that enhance automation capabilities.\u003c/p\u003e\n"],["\u003cp\u003eThe Cron Scheduled Connector triggers playbooks based on alert product, name, and type, using a cron expression for scheduling.\u003c/p\u003e\n"],["\u003cp\u003eThe Scheduled Connector triggers playbooks based on alert product, name, and type, with a configurable run schedule and customizable parameters.\u003c/p\u003e\n"],["\u003cp\u003eBoth connectors share similar mandatory parameters such as Product Field Name, Event Field Name, Alert fields, Alert name and the PythonProcessTimeout parameter.\u003c/p\u003e\n"],["\u003cp\u003eBoth connectors allow for optional parameters such as Alert type and Product Name to be used to further personalize the playbooks.\u003c/p\u003e\n"]]],[],null,["# Connectors\n==========\n\nSupported in: \nGoogle secops [SOAR](/chronicle/docs/secops/google-secops-soar-toc) \n\n**Overview**\n------------\n\nA set of custom connectors used to power up automation capabilities.\n\n**Connectors**\n--------------\n\n### **Cron Scheduled Connector**\n\n**Description**\n\n\nA custom connector created to trigger playbooks by a given alert product, name\nand type and enables editing the parameters according to your specific use\ncase. Allows the use of a cron expression. \n\nUsing the **Run Every** parameter, we recommend updating the connector's scheduled execution from 59 seconds to 1 hour\nand the cron expression accordingly (\\* 16 \\* \\* FRI) to reflect the new schedule.\nThis change ensures that the connector code runs once every hour. The execution\nis not guaranteed to occur exactly at the top of the hour---it will be triggered once at some point during the specified hour.\n\n**Configuration**\nTo configure a connector, go to Settings -\\\u003e Connectors -\\\u003e Create New Connector and search for Cron Scheduled Connector.\n\n\n**Parameters**-\n\n*** ** * ** ***\n\n### **Scheduled Connector**\n\n**Description**\n\n\nA custom connector created to trigger playbooks by a given alert product, name\nand type and enables editing the parameters according to your specific use\ncase.\n\n**Configuration**\n\n\nTo configure a connector, go to Settings -\\\u003e Connectors -\\\u003e Create New\nConnector and search for Scheduled Connector.\n\n\n**Parameters**\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
